When do I need to encode HTML entities?

Whenever you put untrusted text inside HTML — to prevent it from being parsed as markup. The 5 critical characters in HTML body context are `&`, ` `. In attribute values, also encode `"` and `'`. Modern frameworks (React, Vue) auto-escape `{value}` interpolation, but you still need this when generating HTML by string concatenation.

Named vs numeric entities — which is better?

Named entities (`&`, `<`, `©`) are more readable. Numeric entities (`&`, `&`) work for ANY Unicode code point and don't depend on a parser knowing the name. In HTML5 context, named entities for the common chars are fine. For exotic Unicode (emoji, non-Latin scripts), numeric is safer.

Is this safe to use for XSS prevention?

Encoding alone is one layer. The full defense: HTML-encode in HTML body context, attribute-encode in attribute values, JS-encode in blocks, URL-encode in URLs. Each context has different rules. Use a templating engine that handles context automatically (most modern frameworks do).

Why does decode show characters that look the same as the input?

Some browsers render entities visually identical to the literal character (e.g., `&` displays as `&` once decoded). The DECODE result is the raw character — copy it and paste into a hex viewer to see the actual code point.

`'` is XML/HTML5-valid but was NOT in HTML 4. For maximum compatibility with old parsers, use `'` (the numeric form) for the apostrophe instead of the named entity.

HTML Entity Encode / Decode

Developer Tools· 30 tools

Free HTML entity encoder/decoder. Encode mode escapes special characters (&, <, >, ", ', and non-ASCII) to safe entities so they render correctly inside HTML or are safe in attribute values. Decode mode converts named (`&`), decimal (`&`), and hex (`&`) entities back to their characters. Pure browser — nothing uploaded.

Mode

Encode scope

Input

Body scope · & < >

Attribute scope · & < > " '

All non-ASCII · everything above U+007F as numeric entities

Output

&lt;p class="quote"&gt;Tom said, "It's &lt;em&gt;important&lt;/em&gt; &amp; well-known — résumé.&lt;/p&gt;

Input length

Output length

106

Frequently Asked Questions

References

WHATWG HTML — Named character references — WHATWG
OWASP — XSS Prevention Cheat Sheet — OWASP

Related Tools

URL Encoder / Decoder
Encode or decode URL components and query strings instantly.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 back to plain text.
JSON Diff
Compare two JSON objects and see added, removed, and changed keys with full path. Works on nested structures and arrays — pure browser, nothing uploaded.

Frequently Asked Questions

References and sources

Related Tools